Data Processing Agreement

This agreement forms part of the Terms of Service between you and Jagodana LLC and applies wherever you use the platform to process personal data about someone else. Where it conflicts with the Terms, this agreement governs for that processing.

1. Roles

You are the controller of the personal data you put into the platform - your end users' accounts, profiles, audience records, form submissions and the events you send. We are your processor for it, and we act only on your documented instructions. Configuring the product is how you give those instructions.

We are a controller in our own right only for the data we need to run our business with you: your account, your billing record, and the operational logs that keep the service up. That processing is described in our Privacy Policy.

2. Subject matter and duration

We process your data for as long as your account is open, and for the purpose of providing the modules you use: authentication, workspaces, billing, email, storage, workflows, analytics and tracking. On termination we delete or return your data as described in section 8.

3. Your instructions

We process personal data only to provide the service, and on your instructions. We do not sell it, and we do not use it to train models or to build a profile of anyone.

If an instruction appears to us to breach applicable data protection law, we will tell you rather than carry it out silently.

4. Tracking and advertising vendors

The tags you enable are a special case, and it is worth stating plainly. You are the controller. We are your processor: we install what you configured and transmit what you instructed. The vendors themselves - Google, Meta, and any other you enable - are independent controllers of what they receive, under their own terms. They are your sub-processors, not ours.

Where you enable server-side conversions, you instruct us to send those events on your behalf and confirm you have a lawful basis to do so. We do not transmit an event for an end user who refused consent, and by default we do not transmit one for an end user who was never asked.

5. Confidentiality

Everyone with access to your data is bound by confidentiality obligations, and access is limited to those who need it to operate or support the service.

6. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, tenant isolation at the database level, role-based access control, and audit logging of privileged actions. Our current measures are described on the Security page.

7. Sub-processors

You authorise the sub-processors listed at Sub-processors. We remain responsible for their performance. We will tell you before a new one starts processing your data, and you may object on reasonable data-protection grounds; if we cannot resolve the objection, you may terminate the affected service.

8. Deletion and return

You can export your data at any time through the API or the console. On termination, we delete it within 30 days, except where we are required to keep a record - a billing record, for example - in which case we keep only that, for only as long as required.

9. Data subject requests

The platform gives you the tools to access, correct, export and delete an end user's data yourself. Where you cannot, we assist you within a reasonable time.

10. Personal data breach

We notify you without undue delay, and in any case within 72 hours of becoming aware of a breach affecting your data, with what we know and what we are doing about it.

11. International transfers

Where data leaves the EEA or the UK, the transfer relies on the Standard Contractual Clauses or an adequacy decision. The location of each sub-processor is listed on the Sub-processors page.

12. Audits and signature

We make available the information needed to demonstrate compliance with this agreement, and will respond to a reasonable security questionnaire once a year.

Using the service constitutes acceptance of these terms. If your procurement process needs a countersigned copy, write to [email protected] and we will send one.